CVE-2009-2481: mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows rem...

Security readout for executives and security teams

This older Movable Type flaw can let a remote attacker bypass intended restrictions in mt-wizard.cgi when global templates are not initialized. Reported impacts are sending email to arbitrary recipients and obtaining sensitive information. The supplied sources do not provide CVSS, CWE, or detailed exploitation evidence. Likely limited to legacy Movable Type deployments older than 4.261 where mt-wizard.cgi remains reachable and global templates are not initialized. The bundle does not identify CPEs, deployment prevalence, or specific affected configurations beyond the description. Prioritize if the organization still runs legacy Movable Type exposed to the internet. For most environments, urgency depends entirely on whether old Movable Type instances exist; the supplied evidence does not support broad active-exploitation claims. Mitigation focus: Identify any Movable Type installations older than 4.261.; Upgrade affected Movable Type systems to 4.261 or later where supported.; Review Six Apart or JVN guidance before changing CGI access controls..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.